docs: record the recent security hardenings in NEWS.md and SECURITY.md

NEWS.md: extend the robustness-hardening section with the second-pass source
audit (hashtable/flist size-computation integer overflows, non-positive
MSG_IO_TIMEOUT reject, async-signal-safe SIGUSR2 handler) and the source-side
xattr/ACL metadata read confinement plus the fake-super cross-tree metadata-apply
fd-pin.

SECURITY.md: note in the operator-directory residual writeup that the cross-tree
metadata apply on a --temp-dir/--backup-dir leaf is fd-pinned the same way the
reads now are, including under --fake-super (previously am_root >= 0 only).

NEWS.md

@@ -174,6 +174,19 @@ are length-bounded; peer-requested xattr expansion is capped; and rsync-ssl in
 stunnel mode now requires certificate verification unless an explicit insecure
 opt-out is set.
 
+A second-pass source audit (reported by Leonid Bugaev) hardened several memory-
+safety and robustness paths: the hashtable and file-list size computations are
+guarded against a 32-bit integer overflow that a peer's entry count could
+otherwise wrap into an under-allocation; a non-positive `MSG_IO_TIMEOUT` from the
+peer is rejected rather than disabling the receiver's own I/O timeout; and the
+`SIGUSR2` handler is now async-signal-safe (it only sets a flag, deferring the
+summary/close-out work to safe poll points).  Separately, the xattr/ACL metadata
+copy now reads the *source* through a held no-follow fd as well as writing the
+destination through one -- closing a parent-symlink race on the `--copy-dest` and
+backup source -- and the cross-tree operator-path metadata apply is now fd-pinned
+under `--fake-super` too (previously it fell back to a path-based set for a
+`fake super = yes` daemon staging through an absolute `--temp-dir`/`--backup-dir`).
+
 ### BEHAVIOR CHANGES:
 
 - A non-daemon receiver follows an operator-named symlinked destination directory

SECURITY.md

@@ -400,7 +400,14 @@ The following are documented as out of scope for this release:
   `copy_file()`/`copy_xattrs()` source read goes through the held basis content fd
   (`sys_fgetxattr`), and `make_backup()` reads the backed-up file's ACL/xattrs
   through a `backup_source_fd()`-pinned fd -- so a parent-component flip can no
-  longer redirect them to disclose an out-of-module value.  Two narrow follow-ons
+  longer redirect them to disclose an out-of-module value.  The cross-tree
+  metadata *apply* on those leaves (the `%stat`/ACL/xattr write on a
+  `--temp-dir`/`--backup-dir` staging file) is fd-pinned the same way, now
+  including under `--fake-super`: the `set_file_attrs()` no-follow leaf fd was
+  previously opened only when `am_root >= 0`, so a `fake super = yes` daemon fell
+  back to a path-based `sys_lsetxattr()`/chmod a raced parent could redirect; the
+  pin is now opened for fake-super too (a raced leaf is refused, not redirected).
+  Two narrow follow-ons
   re-resolve the (now-validated) operator path by name and remain a
   *post-validation* parent-component race:
     * the in-place backup (`--inplace --backup`) writes the backup file's data